# Connect NinjaOne

> Create a NinjaOne API Services app, connect it to Vigilbase OS read-only, and optionally add a separate app for response actions.

Source: https://docs.vigilbase.com/os/integrations/ninjaone

The NinjaOne connector reads devices, organisations, hardware, installed software, condition alerts, antivirus posture and threats, patch posture and the activity audit trail for the organisations you allow. With a separate write app it can propose device actions such as a reboot, a patch scan or applying patches. Every change still needs an approved plan.

> [!NOTE]
> This connector is **Alpha**: built and tested in isolation, not yet proven against a live account.

## Before you start

- In NinjaOne you need the System administrator role.
- In Vigilbase OS you need the `integration.manage` and `credential.manage` permissions.
- A white-label or custom NinjaOne address is not supported.

## Create a read-only app

:::steps
1. **Open Client App IDs.** In NinjaOne, go to **Configuration › Apps › API › Client App IDs** and choose **Add**.
2. **Choose API Services (machine-to-machine).** Name it `Vigilbase OS (read-only)` and leave Redirect URIs empty.
3. **Set scopes and grant type.** Under Scopes, tick only **Monitoring**. Under Allowed Grant Types, tick only **Client Credentials**.
4. **Save.** Copy the Client ID and Client Secret.
:::

## Connect it to Vigilbase OS

:::steps
1. **Open Integrations, choose Add connection and select NinjaOne.**
2. **Choose the Instance region.** It matches the address you sign in at: `eu.ninjarmm.com` is EU.
3. **Enter the Allowed organization IDs.** These numeric NinjaOne organisation IDs, separated by commas, are the boundary of what Vigilbase reads.
4. **Paste the Client ID and Client secret.**
5. **Finish the wizard.** Validate the connection, then choose datasets.
:::

Optional settings:

- **Own the entire instance**: opt in to instance-wide technician and admin records.
- **Protected device tags**: comma-separated device tags to treat as protected.
- **Services eligible for START/RESTART**: exact Windows service names that actions may start or restart.

## Add response actions (optional)

:::steps
1. **Create a second API Services app** named `Vigilbase OS (response actions)`.
2. **Tick only Management** under Scopes and only **Client Credentials** under Allowed Grant Types. Never tick Control. Keep this app separate from the read-only app.
3. **Save, then copy its Client ID and Client Secret.**
4. **In Vigilbase OS, open the connection and choose Add write access.** Paste the write app's details.
:::

Possible actions are rebooting a device, ending maintenance mode, starting or restarting an allowed Windows service, running a patch scan, applying patches and rejecting pending patches. Reboots and applying patches are irreversible.